#!/bin/sh
# Copyright (C) 2024-2025 KoudaiPC Computer Technologies Co., Ltd.
# script name: huangdi-customize-openwrt.sh
# author: david921518@qq.com

# 1. change password
echo 'koudaipc' > passwd.tmp
echo 'koudaipc' >> passwd.tmp
passwd root -a SHA512 < passwd.tmp
rm -f passwd.tmp

# 2. change ADMIN-SSH port
uci set dropbear.main.Port=50022
uci commit
service dropbear restart

# 3. change apk download URL
#sed "s#downloads.openwrt.org#mirrors.aliyun.com/openwrt#g" -i /etc/apk/distfeeds.conf
apk update

# 4. remove uhttpd & dnsmasq
apk del --force-depends uhttpd
apk del --force-depends dnsmasq

# 5. install nginx
apk install nginx-full

# 6. setup ADMIN-HTTPS port
uci delete nginx._lan.listen
uci add_list nginx._lan.listen='50443 ssl default_server'
uci add_list nginx._lan.listen='[::]:50443 ssl default_server'
uci commit

# 7. setup ADMIN-HTTP port redirect
uci delete nginx._redirect2ssl.listen
uci add_list nginx._redirect2ssl.listen='50080'
uci add_list nginx._redirect2ssl.listen='[::]:50080'
uci set nginx._redirect2ssl.return='302 https://$host:50443$request_uri'
uci commit

# 8. remove restrict locally
sed "s#deny all;#allow all;#g" -i /etc/nginx/restrict_locally

# 9. install Standard OpenWRT set
apk install luci-nginx

# 10. restart nginx HTTP service
service nginx restart

# 11. install bind name service
apk install bind-tools
apk install bind-server
apk install bind-client
sed "s#/tmp/bind/named.conf.local#/etc/bind/named.conf.local#g" -i /etc/bind/named.conf
touch /etc/bind/named.conf.local

# 12. install acme for Let's Encrypt SSL certificates
apk install acme
apk install acme-acmesh-dnsapi
apk install luci-app-acme
apk install luci-i18n-acme-zh-cn

# 13. install docker
apk install docker
apk install dockerd
apk install luci-app-dockerman
apk install luci-i18n-dockerman-zh-cn

# 14. install ttyd
apk install ttyd
apk install luci-app-ttyd
apk install luci-i18n-ttyd-zh-cn

# 15. customize for Chinese
apk install luci-i18n-base-zh-cn
apk install luci-i18n-firewall-zh-cn
apk install luci-i18n-package-manager-zh-cn

# 16. install diff tools
apk install diffutils

# 17. setup wan6 interface
uci set network.wan6=interface
uci set network.wan6.proto=dhcpv6
uci set network.wan6.device=eth0
uci set network.wan6.reqaddress=try
uci set network.wan6.reqprefix=auto
uci set network.wan6.norelease=1
uci set network.globals.packet_steering=1
uci commit

# 18. setup firewall
uci set firewall.@defaults[0].synflood_protect=1
uci set firewall.@defaults[0].drop_invalid=1

result=$(uci get firewall.@redirect[0])
if [ $result == "redirect" ]; then
  echo "has firewall.@redirect[0]"
else
  uci add firewall redirect
fi
uci set firewall.@redirect[0]=redirect
uci set firewall.@redirect[0].dest='lan'
uci set firewall.@redirect[0].target='DNAT'
uci set firewall.@redirect[0].name='SSH-ADMIN'
uci set firewall.@redirect[0].family='ipv4'
uci set firewall.@redirect[0].proto='tcp'
uci set firewall.@redirect[0].src='wan'
uci set firewall.@redirect[0].src_dport='50022'
uci set firewall.@redirect[0].dest_ip='192.168.1.1'
uci set firewall.@redirect[0].dest_port='50022'

result=$(uci get firewall.@redirect[1])
if [ $result == "redirect" ]; then
  echo "has firewall.@redirect[1]"
else
  uci add firewall redirect
fi
uci set firewall.@redirect[1]=redirect
uci set firewall.@redirect[1].dest='lan'
uci set firewall.@redirect[1].target='DNAT'
uci set firewall.@redirect[1].name='SSH-ADMIN6'
uci set firewall.@redirect[1].family='ipv6'
uci set firewall.@redirect[1].proto='tcp'
uci set firewall.@redirect[1].src='wan'
uci set firewall.@redirect[1].src_dport='50022'
uci set firewall.@redirect[1].dest_port='50022'

result=$(uci get firewall.@redirect[2])
if [ $result == "redirect" ]; then
  echo "has firewall.@redirect[2]"
else
  uci add firewall redirect
fi
uci set firewall.@redirect[2]=redirect
uci set firewall.@redirect[2].dest='lan'
uci set firewall.@redirect[2].target='DNAT'
uci set firewall.@redirect[2].name='HTTP-ADMIN'
uci set firewall.@redirect[2].family='ipv4'
uci set firewall.@redirect[2].proto='tcp'
uci set firewall.@redirect[2].src='wan'
uci set firewall.@redirect[2].src_dport='50080'
uci set firewall.@redirect[2].dest_ip='192.168.1.1'
uci set firewall.@redirect[2].dest_port='50080'

result=$(uci get firewall.@redirect[3])
if [ $result == "redirect" ]; then
  echo "has firewall.@redirect[3]"
else
  uci add firewall redirect
fi
uci set firewall.@redirect[3]=redirect
uci set firewall.@redirect[3].dest='lan'
uci set firewall.@redirect[3].target='DNAT'
uci set firewall.@redirect[3].name='HTTP-ADMIN6'
uci set firewall.@redirect[3].family='ipv6'
uci set firewall.@redirect[3].proto='tcp'
uci set firewall.@redirect[3].src='wan'
uci set firewall.@redirect[3].src_dport='50080'
uci set firewall.@redirect[3].dest_port='50080'

result=$(uci get firewall.@redirect[4])
if [ $result == "redirect" ]; then
  echo "has firewall.@redirect[4]"
else
  uci add firewall redirect
fi
uci set firewall.@redirect[4]=redirect
uci set firewall.@redirect[4].dest='lan'
uci set firewall.@redirect[4].target='DNAT'
uci set firewall.@redirect[4].name='HTTPS-ADMIN'
uci set firewall.@redirect[4].family='ipv4'
uci set firewall.@redirect[4].proto='tcp'
uci set firewall.@redirect[4].src='wan'
uci set firewall.@redirect[4].src_dport='50443'
uci set firewall.@redirect[4].dest_ip='192.168.1.1'
uci set firewall.@redirect[4].dest_port='50443'

result=$(uci get firewall.@redirect[5])
if [ $result == "redirect" ]; then
  echo "has firewall.@redirect[5]"
else
  uci add firewall redirect
fi
uci set firewall.@redirect[5]=redirect
uci set firewall.@redirect[5].dest='lan'
uci set firewall.@redirect[5].target='DNAT'
uci set firewall.@redirect[5].name='HTTPS-ADMIN6'
uci set firewall.@redirect[5].family='ipv6'
uci set firewall.@redirect[5].proto='tcp'
uci set firewall.@redirect[5].src='wan'
uci set firewall.@redirect[5].src_dport='50443'
uci set firewall.@redirect[5].dest_port='50443'

uci commit


# 19. setup dockerd
uci set dockerd.globals.iptables='0'
uci delete dockerd.globals.registry_mirrors
uci add_list dockerd.globals.registry_mirrors='https://hub.rat.dev'
uci add_list dockerd.globals.registry_mirrors='https://lynn520.xyz'

uci commit

# 20. remove iptables
apk del --force-depends iptables-zz-legacy
apk del --force-depends iptables-mod-extra
apk del --force-depends ip6tables-zz-legacy

# 21. setup ttyd
uci set ttyd.@ttyd[0].interface='br-lan'
uci set ttyd.@ttyd[0].command='/bin/login'
uci set ttyd.@ttyd[0].port='57681'
uci set ttyd.@ttyd[0].uid='0'
uci set ttyd.@ttyd[0].gid='0'
uci set ttyd.@ttyd[0].ssl='1'
uci set ttyd.@ttyd[0].ssl_cert='/etc/nginx/conf.d/_lan.crt'
uci set ttyd.@ttyd[0].ssl_key='/etc/nginx/conf.d/_lan.key'
uci set ttyd.@ttyd[0].debug='7'
uci set ttyd.@ttyd[0].once='1'
uci set ttyd.@ttyd[0].ipv6='1'

uci commit

# 22. add port-forwarding for ttyd
result=$(uci get firewall.@redirect[6])
if [ $result == "redirect" ]; then
  echo "has firewall.@redirect[6]"
else
  uci add firewall redirect
fi
uci set firewall.@redirect[6]=redirect
uci set firewall.@redirect[6].dest='lan'
uci set firewall.@redirect[6].target='DNAT'
uci set firewall.@redirect[6].name='TTYD-ADMIN'
uci set firewall.@redirect[6].family='ipv4'
uci set firewall.@redirect[6].proto='tcp'
uci set firewall.@redirect[6].src='wan'
uci set firewall.@redirect[6].src_dport='57681'
uci set firewall.@redirect[6].dest_ip='192.168.1.1'
uci set firewall.@redirect[6].dest_port='57681'

result=$(uci get firewall.@redirect[7])
if [ $result == "redirect" ]; then
  echo "has firewall.@redirect[7]"
else
  uci add firewall redirect
fi
uci set firewall.@redirect[7]=redirect
uci set firewall.@redirect[7].dest='lan'
uci set firewall.@redirect[7].target='DNAT'
uci set firewall.@redirect[7].name='TTYD-ADMIN6'
uci set firewall.@redirect[7].family='ipv6'
uci set firewall.@redirect[7].proto='tcp'
uci set firewall.@redirect[7].src='wan'
uci set firewall.@redirect[7].src_dport='57681'
uci set firewall.@redirect[7].dest_port='57681'

uci commit

# 23. enable ttylonin
uci set system.@system[0].ttylogin='1'

uci commit

# 24. set hostname
uci set system.@system[0].hostname='HuangDi'

uci commit

# 25. set timezone
apk install zoneinfo-all 

uci set system.@system[0].timezone='CST-8'
uci set system.@system[0].zonename='Asia/Shanghai'
uci set system.@system[0].log_proto='udp'
uci set system.@system[0].conloglevel='8'
uci set system.@system[0].cronloglevel='7'

uci commit

# 26. set luci language
uci set luci.main.lang='zh_cn'

uci commit

# 27. set luci theme
uci set luci.main.mediaurlbase='/luci-static/bootstrap-dark'

uci commit

# 28. install sftp server
apk install openssh-sftp-server

# restart system
#poweroff

